@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/oauth-kernel.d.mts

@@ -1,1423 +0,0 @@
-import { NativeDatabase } from "./transaction-kernel.mjs";
-import { QueryOperations, SqlExpression, SqlFragment, TableModel } from "./query-operations.mjs";
-import { OAuthReferenceGuardDescriptor, OAuthRegistrationAuthority } from "./models/oauth-model.mjs";
-import { OAuthConnectedMapping } from "./models/oauth-connected-model.mjs";
-import { Mapping, Revocations } from "./oauth/connected-state.mjs";
-import { OAuthCoordinatorError, OAuthTargetConfiguration, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer } from "./oauth/target.mjs";
-import "./sql-oauth-model.mjs";
-import { oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer } from "./oauth/connected-target.mjs";
-import { Effect } from "effect";
-import { SqlClient } from "effect/sql/SqlClient";
-//#region src/internal/oauth-kernel.d.ts
-export type OAuthKernel = ReturnType<typeof makeOAuthKernel>;
-/** Adapter composition root. Shared operation Layers acquire their dependencies;
- * database and transaction services are still resolved by each operation. */
-export declare const makeOAuthKernel: (operations: QueryOperations, dialect: (table: object) => "pg" | "sqlite" | "mysql") => {
-  target: {
-    makeTargetOAuthSignInServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-      oauthSignInPersistence: {
-        readonly issue: <A>(input: import("@yielded/auth/OAuth").OAuthPendingFlow, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly claim: <A>(input: {
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly generation: number;
-          readonly flowId: import("@yielded/auth/Operations").RequestBindingFlowId;
-          readonly provider: import("@yielded/auth/OAuth").OAuthProviderKey;
-          readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-          readonly stateDigest: import("@yielded/auth/Schema").TokenDigest;
-          readonly requestBindingVerifier: import("@yielded/auth/Schema").TokenDigest;
-          readonly requestBindingExpiresAtMillis: number;
-          readonly responseIssuer?: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-          readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-          readonly nowMillis: number;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthClaimDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly settle: <A>(input: {
-          readonly claim: import("@yielded/auth/OAuth").OAuthClaim;
-          readonly outcome: {
-            readonly _tag: "Verified";
-            readonly identity: import("@yielded/auth/OAuth").OAuthVerifiedExternalIdentity;
-          } | {
-            readonly _tag: "Cancelled" | "Rejected" | "Ambiguous";
-          };
-          readonly nowMillis: number;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthSettlementDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly cleanup: <A>(input: import("@yielded/auth/OAuth").OAuthCleanupInput, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly terminalized: number;
-          readonly removed: number;
-          readonly hasMore: boolean;
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-      };
-    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    makeTargetOAuthRegistrationIntentServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-      oauthRegistrationIntents: {
-        readonly settle: <A>(input: {
-          readonly claim: import("@yielded/auth/OAuth").OAuthClaim;
-          readonly identity: import("@yielded/auth/OAuth").OAuthVerifiedExternalIdentity;
-          readonly intent?: import("@yielded/auth/OAuth").OAuthRegistrationIntent;
-          readonly nowMillis: number;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthRegistrationSettlement, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-      };
-    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    makeTargetOAuthRegistrationServices: <Registration>(mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-      registrationAuthority: OAuthRegistrationAuthority<Registration>;
-    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    makeTargetOAuthAccountsServices: (mapping: any, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-      oauthAccountsPersistence: {
-        readonly capture: (input: {
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-        }) => Effect.Effect<import("@yielded/auth/OAuth").OAuthAccountRevision | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly issue: <A>(input: {
-          readonly flow: import("@yielded/auth/OAuth").OAuthLinkPendingFlow;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Issued";
-          readonly flow: {
-            readonly context: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly protocol: "oauth" | "oidc";
-              readonly configurationGeneration: number;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly responseIssuerMode: "required" | "unsupported";
-              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-              readonly generation: number;
-              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-              readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-              readonly access?: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-              readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-              readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-              readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-              readonly requestBindingExpiresAtMillis: number;
-              readonly issuedAtMillis: number;
-              readonly expiresAtMillis: number;
-              readonly claimLifetimeMillis: number;
-              readonly namespace: "effect-auth/oauth-link-context/v1";
-              readonly revision: {
-                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly credentials: readonly {
-                  readonly credentialId: string;
-                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                }[];
-              };
-              readonly maximumEvidenceAgeMillis: number;
-            };
-            readonly sealed: {
-              readonly format: "oauth-xchacha20poly1305-v1";
-              readonly keyId: string;
-              readonly nonce: string;
-              readonly ciphertext: import("effect/Redacted").Redacted<string>;
-            };
-            readonly retentionUntilMillis: number;
-          };
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly preflight: (input: import("@yielded/auth/OAuth").OAuthLinkAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthLinkPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly claim: <A>(input: {
-          readonly access: import("@yielded/auth/OAuth").OAuthLinkAccess;
-          readonly flow: import("@yielded/auth/OAuth").OAuthLinkPendingFlow;
-          readonly claimId: import("@yielded/auth/OAuth").OAuthLinkClaim["claimId"];
-          readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Claimed";
-          readonly claim: {
-            readonly flow: {
-              readonly context: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly protocol: "oauth" | "oidc";
-                readonly configurationGeneration: number;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly responseIssuerMode: "required" | "unsupported";
-                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-                readonly generation: number;
-                readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-                readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-                readonly access?: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-                readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-                readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-                readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-                readonly requestBindingExpiresAtMillis: number;
-                readonly issuedAtMillis: number;
-                readonly expiresAtMillis: number;
-                readonly claimLifetimeMillis: number;
-                readonly namespace: "effect-auth/oauth-link-context/v1";
-                readonly revision: {
-                  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-                  readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                  readonly credentials: readonly {
-                    readonly credentialId: string;
-                    readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                  }[];
-                };
-                readonly maximumEvidenceAgeMillis: number;
-              };
-              readonly sealed: {
-                readonly format: "oauth-xchacha20poly1305-v1";
-                readonly keyId: string;
-                readonly nonce: string;
-                readonly ciphertext: import("effect/Redacted").Redacted<string>;
-              };
-              readonly retentionUntilMillis: number;
-            };
-            readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-            readonly claimedAtMillis: number;
-            readonly claimExpiresAtMillis: number;
-          };
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly settle: <A>(input: {
-          readonly claim: import("@yielded/auth/OAuth").OAuthLinkClaim;
-          readonly outcome: import("@yielded/auth/OAuth").OAuthLinkOutcome;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-          readonly invalidation: import("@yielded/auth/Sessions").SessionInvalidationWindow;
-          readonly nowMillis: number;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Cancelled";
-        } | {
-          readonly _tag: "Ambiguous";
-        } | {
-          readonly _tag: "Conflict";
-        } | {
-          readonly _tag: "Linked";
-          readonly credential: {
-            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-            readonly identity: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly subject: string;
-            };
-            readonly credentialId: string;
-            readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly revision: {
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly credentials: readonly {
-                readonly credentialId: string;
-                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              }[];
-            };
-          };
-          readonly changed: boolean;
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly inspectUnlink: (input: {
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-          readonly credentialId: string;
-        }) => Effect.Effect<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Conflict";
-        } | {
-          readonly _tag: "Target";
-          readonly credential: {
-            readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-            readonly identity: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly subject: string;
-            };
-            readonly credentialId: string;
-            readonly credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly revision: {
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly credentials: readonly {
-                readonly credentialId: string;
-                readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              }[];
-            };
-          };
-        } | {
-          readonly _tag: "Replay";
-          readonly result: {
-            readonly _tag: "Unlinked";
-            readonly credentialId: string;
-            readonly invalidation: {
-              readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-              readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
-              readonly maximumExposureMillis: number;
-              readonly oldAuthenticationEvidence: "rejected";
-            };
-          };
-        }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly unlink: <A>(input: {
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-          readonly credential: import("@yielded/auth/OAuth").OAuthCredentialSnapshot;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthActionAuthorization;
-          readonly invalidation: import("@yielded/auth/Sessions").SessionInvalidationWindow;
-          readonly nowMillis: number;
-          readonly retentionUntilMillis: number;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Conflict";
-        } | {
-          readonly _tag: "Unlinked";
-          readonly result: {
-            readonly _tag: "Unlinked";
-            readonly credentialId: string;
-            readonly invalidation: {
-              readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-              readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
-              readonly maximumExposureMillis: number;
-              readonly oldAuthenticationEvidence: "rejected";
-            };
-          };
-          readonly replayed: boolean;
-        } | {
-          readonly _tag: "LastSignInMethod";
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly cleanup: <A>(input: import("@yielded/auth/OAuth").OAuthCleanupInput, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly terminalized: number;
-          readonly removed: number;
-          readonly hasMore: boolean;
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-      };
-    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetOAuthRegistration: <Registration, Transaction, A, E, R>(database: any, mapping: any, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
-      readonly registrationAuthority: OAuthRegistrationAuthority<Registration>;
-    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetOAuthSignIn: <Transaction, A, E, R>(database: any, mapping: any, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
-      readonly oauthSignInPersistence: import("@yielded/auth/OAuth").OAuthSignInPersistence["Service"];
-    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetOAuthRegistrationIntents: <Transaction, A, E, R>(database: any, mapping: any, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
-      readonly oauthRegistrationIntents: import("@yielded/auth/OAuth").OAuthRegistrationIntents["Service"];
-    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetOAuthAccounts: <Transaction, A, E, R>(database: any, mapping: any, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
-      readonly oauthAccountsPersistence: import("@yielded/auth/OAuth").OAuthAccountsPersistence["Service"];
-    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    sqlClientOAuthStandaloneGuard: (service: SqlClient["transactionService"] | undefined) => Effect.Effect<void, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-    oauthAccountsPersistenceLayer: typeof oauthAccountsPersistenceLayer;
-    oauthSignInPersistenceLayer: typeof oauthSignInPersistenceLayer;
-    oauthRegistrationIntentsLayer: typeof oauthRegistrationIntentsLayer;
-    oauthRegistrationAuthorityLayer: typeof oauthRegistrationAuthorityLayer;
-  };
-  connectedTarget: {
-    makeTargetOAuthConnectedServices: (mapping: Mapping, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-      oauthConnectedPersistence: {
-        readonly claimSignIn: <A>(input: {
-          readonly claim: import("@yielded/auth/OAuth").OAuthClaim;
-          readonly configuration: import("@yielded/auth/OAuth").OAuthConnectedConfiguration;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<import("@yielded/auth/OAuth").OAuthSignInAccessClaim, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-        readonly inspectSignIn: (input: {
-          readonly reservation: import("@yielded/auth/OAuth").OAuthSignInAccessClaim;
-          readonly credential: import("@yielded/auth/OAuth").OAuthCredentialSnapshot;
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        }) => Effect.Effect<import("@yielded/auth/OAuth").OAuthSignInAccessInspection, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly settleSignIn: <A>(input: {
-          readonly reservation: import("@yielded/auth/OAuth").OAuthSignInAccessClaim;
-          readonly outcome: import("@yielded/auth/OAuth").OAuthSignInAccessOutcome;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Cancelled";
-        } | {
-          readonly _tag: "Ambiguous";
-        } | {
-          readonly _tag: "Connected";
-          readonly grant: {
-            readonly context: {
-              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-              readonly exchangeOrder: string;
-              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly identity: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly subject: string;
-              };
-              readonly configuration: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly protocol: "oauth" | "oidc";
-                readonly configurationGeneration: number;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly responseIssuerMode: "required" | "unsupported";
-                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                readonly profile: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-              };
-              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly metadata: {
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly accessExpiresAtMillis?: number;
-                readonly refreshExpiresAtMillis?: number;
-                readonly useUntilMillis: number;
-                readonly refreshUseUntilMillis?: number;
-                readonly obtainedAtMillis: number;
-                readonly profile?: {
-                  readonly displayName?: string;
-                  readonly handle?: string;
-                  readonly avatarUrl?: string;
-                  readonly profileUrl?: string;
-                  readonly email?: string;
-                  readonly emailVerified?: boolean;
-                  readonly providerData?: {
-                    readonly [x: string]: import("effect/Schema").Json;
-                  };
-                };
-              };
-            };
-            readonly sealed: {
-              readonly format: "oauth-connected-xchacha20poly1305-v1";
-              readonly keyId: string;
-              readonly nonce: string;
-              readonly ciphertext: import("effect/Redacted").Redacted<string>;
-            };
-          };
-        } | {
-          readonly _tag: "Conflict";
-        } | {
-          readonly _tag: "Busy";
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-        readonly capture: (input: {
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-          readonly grantId?: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        }) => Effect.Effect<{
-          readonly revision: import("@yielded/auth/OAuth").OAuthAccountRevision;
-          readonly target?: import("@yielded/auth/OAuth").OAuthConnectedTarget;
-        } | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly issue: <A>(input: {
-          readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Issued";
-          readonly flow: {
-            readonly context: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly protocol: "oauth" | "oidc";
-              readonly configurationGeneration: number;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly responseIssuerMode: "required" | "unsupported";
-              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-              readonly generation: number;
-              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-              readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-              readonly access?: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-              readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-              readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-              readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-              readonly requestBindingExpiresAtMillis: number;
-              readonly issuedAtMillis: number;
-              readonly expiresAtMillis: number;
-              readonly claimLifetimeMillis: number;
-              readonly namespace: "effect-auth/oauth-connected-context/v1";
-              readonly revision: {
-                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly credentials: readonly {
-                  readonly credentialId: string;
-                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                }[];
-              };
-              readonly profile: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-              readonly reconnect?: {
-                readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-                readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly identity: {
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                  readonly subject: string;
-                };
-                readonly configuration: {
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly protocol: "oauth" | "oidc";
-                  readonly configurationGeneration: number;
-                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                  readonly responseIssuerMode: "required" | "unsupported";
-                  readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                  readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                  readonly profile: {
-                    readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                    readonly generation: number;
-                    readonly issuance: "active" | "retired";
-                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                    readonly clientRegistrationId: string;
-                    readonly scopes: readonly string[];
-                    readonly resources: readonly string[];
-                    readonly retention: "access-and-refresh" | "access-only";
-                    readonly maximumAccessLifetimeMillis: number;
-                    readonly maximumRefreshLifetimeMillis?: number;
-                    readonly refreshAheadMillis: number;
-                    readonly refresh: "confidential" | "rotating" | "unsupported";
-                    readonly revocation: "cohort" | "unsupported";
-                  };
-                };
-              };
-              readonly maximumEvidenceAgeMillis: number;
-            };
-            readonly sealed: {
-              readonly format: "oauth-xchacha20poly1305-v1";
-              readonly keyId: string;
-              readonly nonce: string;
-              readonly ciphertext: import("effect/Redacted").Redacted<string>;
-            };
-            readonly retentionUntilMillis: number;
-          };
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-        readonly prepare: <A>(input: {
-          readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Issued";
-          readonly flow: {
-            readonly context: {
-              readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-              readonly protocol: "oauth" | "oidc";
-              readonly configurationGeneration: number;
-              readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-              readonly responseIssuerMode: "required" | "unsupported";
-              readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-              readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-              readonly generation: number;
-              readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-              readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-              readonly access?: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-              readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-              readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-              readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-              readonly requestBindingExpiresAtMillis: number;
-              readonly issuedAtMillis: number;
-              readonly expiresAtMillis: number;
-              readonly claimLifetimeMillis: number;
-              readonly namespace: "effect-auth/oauth-connected-context/v1";
-              readonly revision: {
-                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-                readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly credentials: readonly {
-                  readonly credentialId: string;
-                  readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                }[];
-              };
-              readonly profile: {
-                readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                readonly generation: number;
-                readonly issuance: "active" | "retired";
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly clientRegistrationId: string;
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly retention: "access-and-refresh" | "access-only";
-                readonly maximumAccessLifetimeMillis: number;
-                readonly maximumRefreshLifetimeMillis?: number;
-                readonly refreshAheadMillis: number;
-                readonly refresh: "confidential" | "rotating" | "unsupported";
-                readonly revocation: "cohort" | "unsupported";
-              };
-              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-              readonly reconnect?: {
-                readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-                readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly identity: {
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                  readonly subject: string;
-                };
-                readonly configuration: {
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly protocol: "oauth" | "oidc";
-                  readonly configurationGeneration: number;
-                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                  readonly responseIssuerMode: "required" | "unsupported";
-                  readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                  readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                  readonly profile: {
-                    readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                    readonly generation: number;
-                    readonly issuance: "active" | "retired";
-                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                    readonly clientRegistrationId: string;
-                    readonly scopes: readonly string[];
-                    readonly resources: readonly string[];
-                    readonly retention: "access-and-refresh" | "access-only";
-                    readonly maximumAccessLifetimeMillis: number;
-                    readonly maximumRefreshLifetimeMillis?: number;
-                    readonly refreshAheadMillis: number;
-                    readonly refresh: "confidential" | "rotating" | "unsupported";
-                    readonly revocation: "cohort" | "unsupported";
-                  };
-                };
-              };
-              readonly maximumEvidenceAgeMillis: number;
-            };
-            readonly sealed: {
-              readonly format: "oauth-xchacha20poly1305-v1";
-              readonly keyId: string;
-              readonly nonce: string;
-              readonly ciphertext: import("effect/Redacted").Redacted<string>;
-            };
-            readonly retentionUntilMillis: number;
-          };
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-        readonly inspectPrepared: (input: import("@yielded/auth/OAuth").OAuthConnectedPreparedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly preflight: (input: import("@yielded/auth/OAuth").OAuthConnectedAccess) => Effect.Effect<import("@yielded/auth/OAuth").OAuthConnectedPendingFlow | undefined, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly claim: <A>(input: {
-          readonly access: import("@yielded/auth/OAuth").OAuthConnectedAccess;
-          readonly flow: import("@yielded/auth/OAuth").OAuthConnectedPendingFlow;
-          readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Claimed";
-          readonly claim: {
-            readonly flow: {
-              readonly context: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly protocol: "oauth" | "oidc";
-                readonly configurationGeneration: number;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly responseIssuerMode: "required" | "unsupported";
-                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-                readonly generation: number;
-                readonly flowId: string & import("effect/Brand").Brand<"effect-auth/RequestBindingFlowId">;
-                readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-                readonly access?: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-                readonly returnTarget: string & import("effect/Brand").Brand<"effect-auth/OAuthReturnTarget">;
-                readonly stateDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-                readonly requestBindingVerifier: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-                readonly requestBindingExpiresAtMillis: number;
-                readonly issuedAtMillis: number;
-                readonly expiresAtMillis: number;
-                readonly claimLifetimeMillis: number;
-                readonly namespace: "effect-auth/oauth-connected-context/v1";
-                readonly revision: {
-                  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-                  readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                  readonly credentials: readonly {
-                    readonly credentialId: string;
-                    readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                  }[];
-                };
-                readonly profile: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-                readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-                readonly reconnect?: {
-                  readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-                  readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                  readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                  readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                  readonly identity: {
-                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                    readonly subject: string;
-                  };
-                  readonly configuration: {
-                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                    readonly protocol: "oauth" | "oidc";
-                    readonly configurationGeneration: number;
-                    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                    readonly responseIssuerMode: "required" | "unsupported";
-                    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                    readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                    readonly profile: {
-                      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                      readonly generation: number;
-                      readonly issuance: "active" | "retired";
-                      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                      readonly clientRegistrationId: string;
-                      readonly scopes: readonly string[];
-                      readonly resources: readonly string[];
-                      readonly retention: "access-and-refresh" | "access-only";
-                      readonly maximumAccessLifetimeMillis: number;
-                      readonly maximumRefreshLifetimeMillis?: number;
-                      readonly refreshAheadMillis: number;
-                      readonly refresh: "confidential" | "rotating" | "unsupported";
-                      readonly revocation: "cohort" | "unsupported";
-                    };
-                  };
-                };
-                readonly maximumEvidenceAgeMillis: number;
-              };
-              readonly sealed: {
-                readonly format: "oauth-xchacha20poly1305-v1";
-                readonly keyId: string;
-                readonly nonce: string;
-                readonly ciphertext: import("effect/Redacted").Redacted<string>;
-              };
-              readonly retentionUntilMillis: number;
-            };
-            readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-            readonly claimedAtMillis: number;
-            readonly claimExpiresAtMillis: number;
-            readonly order: string;
-          };
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-        readonly inspectGrant: (input: {
-          readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
-          readonly identity: {
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly subject: string;
-          };
-        }) => Effect.Effect<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Conflict";
-        } | {
-          readonly _tag: "Target";
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        } | {
-          readonly _tag: "Quarantine";
-          readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly settle: <A>(input: {
-          readonly claim: import("@yielded/auth/OAuth").OAuthConnectedClaim;
-          readonly outcome: import("@yielded/auth/OAuth").OAuthConnectedOutcome;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
-          readonly nowMillis: number;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Cancelled";
-        } | {
-          readonly _tag: "Ambiguous";
-        } | {
-          readonly _tag: "Connected";
-          readonly grant: {
-            readonly context: {
-              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-              readonly exchangeOrder: string;
-              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly identity: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly subject: string;
-              };
-              readonly configuration: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly protocol: "oauth" | "oidc";
-                readonly configurationGeneration: number;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly responseIssuerMode: "required" | "unsupported";
-                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                readonly profile: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-              };
-              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly metadata: {
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly accessExpiresAtMillis?: number;
-                readonly refreshExpiresAtMillis?: number;
-                readonly useUntilMillis: number;
-                readonly refreshUseUntilMillis?: number;
-                readonly obtainedAtMillis: number;
-                readonly profile?: {
-                  readonly displayName?: string;
-                  readonly handle?: string;
-                  readonly avatarUrl?: string;
-                  readonly profileUrl?: string;
-                  readonly email?: string;
-                  readonly emailVerified?: boolean;
-                  readonly providerData?: {
-                    readonly [x: string]: import("effect/Schema").Json;
-                  };
-                };
-              };
-            };
-            readonly sealed: {
-              readonly format: "oauth-connected-xchacha20poly1305-v1";
-              readonly keyId: string;
-              readonly nonce: string;
-              readonly ciphertext: import("effect/Redacted").Redacted<string>;
-            };
-          };
-        } | {
-          readonly _tag: "Conflict";
-        } | {
-          readonly _tag: "Busy";
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-        readonly list: (input: {
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-          readonly limit: number;
-          readonly cursor?: string;
-        }) => Effect.Effect<{
-          readonly items: readonly {
-            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-            readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-            readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-            readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-            readonly status: "Active" | "Disconnected" | "ReauthorizationRequired" | "Refreshing";
-            readonly scopes: readonly string[];
-            readonly accessExpiresAtMillis?: number;
-            readonly useUntilMillis: number;
-            readonly profile?: {
-              readonly displayName?: string;
-              readonly handle?: string;
-              readonly avatarUrl?: string;
-              readonly profileUrl?: string;
-              readonly email?: string;
-              readonly emailVerified?: boolean;
-              readonly providerData?: {
-                readonly [x: string]: import("effect/Schema").Json;
-              };
-            };
-            readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-          }[];
-          readonly cursor?: string;
-        }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly inspectDisconnect: (input: {
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-        }) => Effect.Effect<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Conflict";
-        } | {
-          readonly _tag: "Target";
-          readonly grant: {
-            readonly context: {
-              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-              readonly exchangeOrder: string;
-              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly identity: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly subject: string;
-              };
-              readonly configuration: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly protocol: "oauth" | "oidc";
-                readonly configurationGeneration: number;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly responseIssuerMode: "required" | "unsupported";
-                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                readonly profile: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-              };
-              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly metadata: {
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly accessExpiresAtMillis?: number;
-                readonly refreshExpiresAtMillis?: number;
-                readonly useUntilMillis: number;
-                readonly refreshUseUntilMillis?: number;
-                readonly obtainedAtMillis: number;
-                readonly profile?: {
-                  readonly displayName?: string;
-                  readonly handle?: string;
-                  readonly avatarUrl?: string;
-                  readonly profileUrl?: string;
-                  readonly email?: string;
-                  readonly emailVerified?: boolean;
-                  readonly providerData?: {
-                    readonly [x: string]: import("effect/Schema").Json;
-                  };
-                };
-              };
-            };
-            readonly sealed?: {
-              readonly format: "oauth-connected-xchacha20poly1305-v1";
-              readonly keyId: string;
-              readonly nonce: string;
-              readonly ciphertext: import("effect/Redacted").Redacted<string>;
-            };
-          };
-          readonly revision: {
-            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly credentials: readonly {
-              readonly credentialId: string;
-              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            }[];
-          };
-        } | {
-          readonly _tag: "Replay";
-          readonly result: {
-            readonly _tag: "Disconnected";
-            readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-            readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-            readonly affectedGrantCount: number;
-            readonly replayed: boolean;
-          };
-        }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly disconnect: <A>(input: {
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly commandId: string & import("effect/Brand").Brand<"effect-auth/OAuthCommandId">;
-          readonly grant: import("@yielded/auth/OAuth").OAuthConnectedDisconnectGrant;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedActionAuthorization;
-          readonly revocation?: import("@yielded/auth/OAuth").OAuthConnectedRevocationJob;
-          readonly retentionUntilMillis: number;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Disconnected";
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly remoteRevocation: "Confirmed" | "Pending" | "Unknown" | "Unsupported";
-          readonly affectedGrantCount: number;
-          readonly replayed: boolean;
-        } | {
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Conflict";
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-        readonly inspectAccess: (input: {
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly profileKey: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-        }) => Effect.Effect<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Busy";
-        } | {
-          readonly _tag: "Target";
-          readonly grant: {
-            readonly context: {
-              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-              readonly exchangeOrder: string;
-              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly identity: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly subject: string;
-              };
-              readonly configuration: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly protocol: "oauth" | "oidc";
-                readonly configurationGeneration: number;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly responseIssuerMode: "required" | "unsupported";
-                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                readonly profile: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-              };
-              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly metadata: {
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly accessExpiresAtMillis?: number;
-                readonly refreshExpiresAtMillis?: number;
-                readonly useUntilMillis: number;
-                readonly refreshUseUntilMillis?: number;
-                readonly obtainedAtMillis: number;
-                readonly profile?: {
-                  readonly displayName?: string;
-                  readonly handle?: string;
-                  readonly avatarUrl?: string;
-                  readonly profileUrl?: string;
-                  readonly email?: string;
-                  readonly emailVerified?: boolean;
-                  readonly providerData?: {
-                    readonly [x: string]: import("effect/Schema").Json;
-                  };
-                };
-              };
-            };
-            readonly sealed: {
-              readonly format: "oauth-connected-xchacha20poly1305-v1";
-              readonly keyId: string;
-              readonly nonce: string;
-              readonly ciphertext: import("effect/Redacted").Redacted<string>;
-            };
-          };
-        } | {
-          readonly _tag: "ReauthorizationRequired";
-        }, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly claimRefresh: <A>(input: {
-          readonly grant: import("@yielded/auth/OAuth").OAuthConnectedStoredGrant;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-          readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-          readonly nextTokenVersion: import("@yielded/auth/OAuth").OAuthConnectedRefreshClaim["nextTokenVersion"];
-          readonly lifetimeMillis: number;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Busy";
-        } | {
-          readonly _tag: "ReauthorizationRequired";
-        } | {
-          readonly _tag: "Claimed";
-          readonly claim: {
-            readonly grant: {
-              readonly context: {
-                readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-                readonly exchangeOrder: string;
-                readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-                readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-                readonly identity: {
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                  readonly subject: string;
-                };
-                readonly configuration: {
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly protocol: "oauth" | "oidc";
-                  readonly configurationGeneration: number;
-                  readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                  readonly responseIssuerMode: "required" | "unsupported";
-                  readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                  readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                  readonly profile: {
-                    readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                    readonly generation: number;
-                    readonly issuance: "active" | "retired";
-                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                    readonly clientRegistrationId: string;
-                    readonly scopes: readonly string[];
-                    readonly resources: readonly string[];
-                    readonly retention: "access-and-refresh" | "access-only";
-                    readonly maximumAccessLifetimeMillis: number;
-                    readonly maximumRefreshLifetimeMillis?: number;
-                    readonly refreshAheadMillis: number;
-                    readonly refresh: "confidential" | "rotating" | "unsupported";
-                    readonly revocation: "cohort" | "unsupported";
-                  };
-                };
-                readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-                readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                readonly metadata: {
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly accessExpiresAtMillis?: number;
-                  readonly refreshExpiresAtMillis?: number;
-                  readonly useUntilMillis: number;
-                  readonly refreshUseUntilMillis?: number;
-                  readonly obtainedAtMillis: number;
-                  readonly profile?: {
-                    readonly displayName?: string;
-                    readonly handle?: string;
-                    readonly avatarUrl?: string;
-                    readonly profileUrl?: string;
-                    readonly email?: string;
-                    readonly emailVerified?: boolean;
-                    readonly providerData?: {
-                      readonly [x: string]: import("effect/Schema").Json;
-                    };
-                  };
-                };
-              };
-              readonly sealed: {
-                readonly format: "oauth-connected-xchacha20poly1305-v1";
-                readonly keyId: string;
-                readonly nonce: string;
-                readonly ciphertext: import("effect/Redacted").Redacted<string>;
-              };
-            };
-            readonly order: string;
-            readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-            readonly claimedAtMillis: number;
-            readonly claimExpiresAtMillis: number;
-            readonly nextTokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          };
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-        readonly settleRefresh: <A>(input: {
-          readonly claim: import("@yielded/auth/OAuth").OAuthConnectedRefreshClaim;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-          readonly outcome: import("@yielded/auth/OAuth").OAuthConnectedRefreshOutcome;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "ReauthorizationRequired";
-        } | {
-          readonly _tag: "Refreshed";
-          readonly grant: {
-            readonly context: {
-              readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-              readonly exchangeOrder: string;
-              readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-              readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-              readonly identity: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly subject: string;
-              };
-              readonly configuration: {
-                readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                readonly protocol: "oauth" | "oidc";
-                readonly configurationGeneration: number;
-                readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                readonly responseIssuerMode: "required" | "unsupported";
-                readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                readonly profile: {
-                  readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                  readonly generation: number;
-                  readonly issuance: "active" | "retired";
-                  readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                  readonly clientRegistrationId: string;
-                  readonly scopes: readonly string[];
-                  readonly resources: readonly string[];
-                  readonly retention: "access-and-refresh" | "access-only";
-                  readonly maximumAccessLifetimeMillis: number;
-                  readonly maximumRefreshLifetimeMillis?: number;
-                  readonly refreshAheadMillis: number;
-                  readonly refresh: "confidential" | "rotating" | "unsupported";
-                  readonly revocation: "cohort" | "unsupported";
-                };
-              };
-              readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-              readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-              readonly metadata: {
-                readonly scopes: readonly string[];
-                readonly resources: readonly string[];
-                readonly accessExpiresAtMillis?: number;
-                readonly refreshExpiresAtMillis?: number;
-                readonly useUntilMillis: number;
-                readonly refreshUseUntilMillis?: number;
-                readonly obtainedAtMillis: number;
-                readonly profile?: {
-                  readonly displayName?: string;
-                  readonly handle?: string;
-                  readonly avatarUrl?: string;
-                  readonly profileUrl?: string;
-                  readonly email?: string;
-                  readonly emailVerified?: boolean;
-                  readonly providerData?: {
-                    readonly [x: string]: import("effect/Schema").Json;
-                  };
-                };
-              };
-            };
-            readonly sealed: {
-              readonly format: "oauth-connected-xchacha20poly1305-v1";
-              readonly keyId: string;
-              readonly nonce: string;
-              readonly ciphertext: import("effect/Redacted").Redacted<string>;
-            };
-          };
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-        readonly admitUse: <A>(input: {
-          readonly grant: import("@yielded/auth/OAuth").OAuthConnectedStoredGrant;
-          readonly authorization: import("@yielded/auth/OAuth").OAuthConnectedUseAuthorization;
-          readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-          readonly lifetimeMillis: number;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Busy";
-        } | {
-          readonly _tag: "ReauthorizationRequired";
-        } | {
-          readonly _tag: "Admitted";
-          readonly admissionId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-          readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-          readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly admittedAtMillis: number;
-          readonly expiresAtMillis: number;
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-        readonly cleanup: <A>(input: import("@yielded/auth/OAuth").OAuthCleanupInput, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly terminalized: number;
-          readonly removed: number;
-          readonly hasMore: boolean;
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable, never>;
-      };
-    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    makeTargetOAuthConnectedRevocationServices: (mapping: Revocations, configuration: OAuthTargetConfiguration) => Effect.Effect<{
-      oauthConnectedRevocations: {
-        readonly claim: <A>(input: {
-          readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-          readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-          readonly lifetimeMillis: number;
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly _tag: "Claimed";
-          readonly claim: {
-            readonly job: {
-              readonly context: {
-                readonly namespace: "effect-auth/oauth-connected-revocation-context/v1";
-                readonly jobId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-                readonly token: {
-                  readonly namespace: "effect-auth/oauth-connected-token-context/v1";
-                  readonly exchangeOrder: string;
-                  readonly moduleId: string & import("effect/Brand").Brand<"effect-auth/OAuthModuleId">;
-                  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-                  readonly identity: {
-                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                    readonly subject: string;
-                  };
-                  readonly configuration: {
-                    readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                    readonly protocol: "oauth" | "oidc";
-                    readonly configurationGeneration: number;
-                    readonly issuer: string & import("effect/Brand").Brand<"effect-auth/OAuthIssuer">;
-                    readonly responseIssuerMode: "required" | "unsupported";
-                    readonly callbackId: string & import("effect/Brand").Brand<"effect-auth/OAuthCallbackId">;
-                    readonly redirectUri: string & import("effect/Brand").Brand<"effect-auth/OAuthRedirectUri">;
-                    readonly profile: {
-                      readonly key: string & import("effect/Brand").Brand<"effect-auth/OAuthPermissionProfileKey">;
-                      readonly generation: number;
-                      readonly issuance: "active" | "retired";
-                      readonly provider: string & import("effect/Brand").Brand<"effect-auth/OAuthProviderKey">;
-                      readonly clientRegistrationId: string;
-                      readonly scopes: readonly string[];
-                      readonly resources: readonly string[];
-                      readonly retention: "access-and-refresh" | "access-only";
-                      readonly maximumAccessLifetimeMillis: number;
-                      readonly maximumRefreshLifetimeMillis?: number;
-                      readonly refreshAheadMillis: number;
-                      readonly refresh: "confidential" | "rotating" | "unsupported";
-                      readonly revocation: "cohort" | "unsupported";
-                    };
-                  };
-                  readonly grantId: string & import("effect/Brand").Brand<"effect-auth/OAuthGrantId">;
-                  readonly grantVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                  readonly tokenVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                  readonly cohortGeneration: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-                  readonly metadata: {
-                    readonly scopes: readonly string[];
-                    readonly resources: readonly string[];
-                    readonly accessExpiresAtMillis?: number;
-                    readonly refreshExpiresAtMillis?: number;
-                    readonly useUntilMillis: number;
-                    readonly refreshUseUntilMillis?: number;
-                    readonly obtainedAtMillis: number;
-                    readonly profile?: {
-                      readonly displayName?: string;
-                      readonly handle?: string;
-                      readonly avatarUrl?: string;
-                      readonly profileUrl?: string;
-                      readonly email?: string;
-                      readonly emailVerified?: boolean;
-                      readonly providerData?: {
-                        readonly [x: string]: import("effect/Schema").Json;
-                      };
-                    };
-                  };
-                };
-              };
-              readonly sealed: {
-                readonly format: "oauth-connected-xchacha20poly1305-v1";
-                readonly keyId: string;
-                readonly nonce: string;
-                readonly ciphertext: import("effect/Redacted").Redacted<string>;
-              };
-            };
-            readonly claimId: string & import("effect/Brand").Brand<"effect-auth/OAuthClaimId">;
-            readonly claimedAtMillis: number;
-            readonly claimExpiresAtMillis: number;
-          };
-        } | {
-          readonly _tag: "Empty";
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-        readonly settle: <A>(input: {
-          readonly claim: import("@yielded/auth/OAuth").OAuthConnectedRevocationClaim;
-          readonly outcome: "Confirmed" | "Unknown";
-        }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
-          readonly settled: boolean;
-        }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, import("@yielded/auth/OAuth").OAuthUnavailable>;
-      };
-    }, import("@yielded/auth/OAuth").OAuthUnavailable, import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetOAuthConnected: <Transaction, A, E, R>(database: any, mapping: Mapping, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
-      readonly oauthConnectedPersistence: import("@yielded/auth/OAuth").OAuthConnectedPersistence["Service"];
-    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetOAuthConnectedRevocations: <Transaction, A, E, R>(database: any, mapping: Revocations, configuration: OAuthTargetConfiguration, owner: (transaction: Transaction, services: {
-      readonly oauthConnectedRevocations: import("@yielded/auth/OAuth").OAuthConnectedRevocations["Service"];
-    }, append: (statement: import("effect/sql/Statement").Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E>, R | import("effect/Crypto").Crypto | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    oauthConnectedPersistenceLayer: typeof oauthConnectedPersistenceLayer;
-    oauthConnectedRevocationsLayer: typeof oauthConnectedRevocationsLayer;
-  };
-  connectedReference: {
-    oauthConnectedOwnershipReferences: <S extends TableModel, AC extends TableModel, T extends TableModel, O extends TableModel, F extends TableModel, G extends TableModel, C extends TableModel, H extends TableModel, A extends TableModel, D extends TableModel, N, J extends TableModel>(original: OAuthConnectedMapping<S, AC, T, O, F, G, C, H, A, D, N, J, any>) => {
-      readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
-      readonly connectedReference: (input: {
-        readonly identityKey: string;
-        readonly subjectId: N;
-      }) => SqlExpression;
-    };
-    connectedReferenceCondition: (mapping: Mapping, identityKey: string | SqlExpression, knownIdentity?: {
-      readonly provider: string | SqlExpression;
-      readonly issuer: string | SqlExpression;
-    }) => SqlFragment;
-  };
-};
-//#endregion
-//# sourceMappingURL=oauth-kernel.d.mts.map